Subject: Re: bug#74556: 30.0.92; Package upgrade can fail and results in deleted package

From: Philip Kaludercic <[email-masked]>
Date: Thu, 28 Nov 2024 11:11:33 +0000

Daniel Mendler <[email-masked]> writes:

> Package upgrade can fail when the package metadata is out of sync. The
> upgrade process first deletes the package, tries to download the new
> version. If the download fails for some reason (metadata out of sync or
> the file not available), the upgrade aborts but the earlier package
> deletion is not rolled back as one would expect for an upgrade
> transaction. Ideally the download would be performed first such that the
> upgrade process wouldn't lead to a missing package.
>
> I just executed M-x package-upgrade-all. The following messages appeared
> in the log:
>
> Package ‘<package>-<old-version>’ deleted.
> Contacting host: elpa.gnu.org:443
> package--with-response-buffer-1:
> https://elpa.gnu.org/devel/<pkgname>-<new-version>.tar: No Data

I cannot test this out right now, but it seems that the fix should be
straight-forward

diff --git a/lisp/emacs-lisp/package.el b/lisp/emacs-lisp/package.el
index 438af781393..46b2d7580c1 100644
--- a/lisp/emacs-lisp/package.el
+++ b/lisp/emacs-lisp/package.el
@@ -2268,12 +2268,16 @@ package-upgrade
     ;; `pkg-desc' will be nil when the package is an "active built-in".
     (if (and pkg-desc (package-vc-p pkg-desc))
         (package-vc-upgrade pkg-desc)
-      (when pkg-desc
-        (package-delete pkg-desc 'force 'dont-unselect))
       (package-install package
                        ;; An active built-in has never been "selected"
                        ;; before.  Mark it as installed explicitly.
-                       (and pkg-desc 'dont-select)))))
+                       (and pkg-desc 'dont-select))
+      ;; We delete the old package via the descriptor after installing
+      ;; the new package to avoid losing the package if there issues
+      ;; during installation (Bug#74556).
+      (cl-assert (package-desc-dir pkg-desc))
+      (when pkg-desc
+        (package-delete pkg-desc 'force 'dont-unselect)))))
 
 (defun package--upgradeable-packages (&optional include-builtins)
   ;; Initialize the package system to get the list of package

It might make sense to try and "deactivate" a package before installing
the new package.  Looking into some second-try fallback for
package-install to refresh the package index if a package was not found
would also be a good idea ^^